What happens to your photo
Last updated October 29, 2026. This page describes how the site actually works.
The short version
- No account, no password, no phone number.
- Your photo is used only to make your previews. It is never sold, never used for marketing, and never used to train AI.
- The original is deleted 24 hours after upload if you don’t buy. If you buy, it’s deleted 60 minutes after your HD images are finished: that hour is when the one free redo per image (and the upgrade to all 3 shapes) is available.
- Previews and HD images auto-delete after 7 days. The Delete now button removes everything immediately.
- Google keeps AI requests for up to 55 days for abuse monitoring only (details below).
What we collect
- Your photo. Before upload, your browser re-saves it as a JPEG, which removes location (GPS) and other EXIF data. Our server re-encodes it again and keeps a version no larger than 1600 pixels.
- Your consent. The time you ticked the consent box and which version of the wording you agreed to.
- A session cookie. A random code that links your browser to your photo. We store only a hash of it.
- Orders. Which option you bought, the amount, and Stripe’s payment reference. We do not store your card or your email.
- Rate-limit counters. A salted hash of your IP address, kept 48 hours, to stop abuse of the free preview.
Who processes your data
| Service | Why | What it gets | How long |
|---|---|---|---|
| Cloudflare | Hosting and bot protection (Turnstile) | Requests to the site, your IP address | Request logs per Cloudflare’s default retention; we never log photos or request bodies |
| Supabase | Database and private photo storage | Your photo, previews, and the records above | As set out below; database backups hold no images and roll off within 7 days |
| Google (Gemini API) | Creating your preview images | Your photo and our text prompt, sent directly in the request | Up to 55 days for abuse monitoring (below) |
| Stripe | Payments | The product, the price, and the email and card details you type at checkout | Per Stripe’s privacy policy and legal duties |
| Resend | Emailing you a private link, only if you ask | Your email address and the link | Per Resend’s policy; we don’t keep your email |
Google Gemini and the 55-day abuse check
We call Google’s Gemini API directly on a paid (billing-enabled) account. Under Google’s terms for paid services, Google does not use your prompts, photos or results to improve its products. Google does keep prompts and outputs for up to 55 days solely to detect and prevent violations of its policies. This retention can’t be switched off on the Gemini API. We have turned off Gemini API logging and do not create datasets. Images are sent only inside the request; we don’t use Google’s file storage or caching.
How long each copy lasts
| Item | Deleted |
|---|---|
| Original photo, if you don’t buy | 24 hours after upload |
| Original photo, if you buy (or use a code) | 60 minutes after your HD images are finished, so the one free redo per image works during that hour. If they can’t be made, it goes 24 hours after upload or 2 hours after payment, whichever is later. |
| Original photo, if you upgrade to all 3 shapes | Starting the upgrade checkout holds it for up to 45 minutes so the payment can finish. After you pay, it’s deleted 60 minutes after the new images are finished. |
| Free preview and HD images | 7 days after they’re made |
| Private result link | Stops working when the images are deleted, or when you make a new link |
| IP hashes for rate limits | 48 hours |
| Order records (no photo, no email) | Kept for accounting |
Deletions run automatically every 15 minutes, so an item can last up to 15 minutes past the times above. Delete now is immediate.
An automatic job runs every 15 minutes to remove expired items.
Delete now
The Delete my photos now button on your preview and results pages removes your original, every preview and HD image, and your session right away. Or email hello@smpmirror.com.
Who can see your photo
Only you, through short-lived (5-minute) signed links, or anyone you give your private link to. Our admin screen shows orders and totals only. It cannot display customer photos or images.
Cookies and tracking
We use one essential session cookie. No advertising pixels or third-party analytics run on any page that handles your photo. If we measure visits, we use cookieless, page-view-only analytics.
Example images
The faces on our marketing pages are illustrations. We only ever show a real customer’s before and after with their separate, written permission.
Your rights
You can ask what we hold about you, or ask us to delete it, at hello@smpmirror.com. Because we don’t know your name or email, the fastest way is the Delete now button in the browser you used.